Privacy Policy

1. Who is responsible for your data

The controller of your personal data is I.T. House, the registered Sri Lankan business that operates Nalla Nikah (nallanikah.com). Our registration number is shown in the footer of every page, and you can reach us using the contact details in section 10.

2. What we collect

Account details

• Your name and mobile number (required to register).
• An email address and password, only if you choose to add them.
• Verification records: when a number was verified, and hashed one-time codes.

Matrimonial profile

• Display name, gender, date of birth, height, weight, blood group and marital status.
• Religious details you choose to give: jamath and movement.
• Language, education level and stream, occupation, parents' occupations, number of brothers and sisters.
• Address as the Sri Lankan administrative hierarchy — province, district, DS division, GN division — plus a house/street line.
• Contact mobile number and contact email for proposals.
• Your free-text “about me” summary and partner preferences.

Technical data

• A session cookie so you stay signed in, and a CSRF cookie that protects forms. We do not use advertising or third-party tracking cookies.
• Standard server logs kept by our host (IP address, browser, pages requested, timestamps) used for security and troubleshooting.

We do not ask for your NIC number, and we never collect or store card or bank details.

3. Why we use it, and on what basis

• To run the service — creating your account, showing your approved profile to other members, and letting matches contact you. This is what you sign up for (performance of our agreement with you).
• To verify identity and keep the site safe — SMS one-time codes, admin review of every profile, blocking abuse and fraud (our legitimate interest in a trustworthy service).
• To support you — answering your messages and service notices about your account.
• To meet legal obligations — where the law requires us to keep records or respond to lawful requests.

We do not sell your data, rent it, or use it for third-party advertising.

4. Who can see your profile

• Nobody, until we approve it. A new or edited profile is pending and is not listed.
• Signed-in members only. Approved profiles are visible to other logged-in, verified members — never to the open web. The listing is not public and is not indexed by search engines.
• Our admin team. A small number of administrators can see profile data in order to review, approve, correct or remove it.
• Your contact details (mobile and contact email) are shown to signed-in members so that families can speak directly. If you do not want a number shared, do not enter it as your contact number.

5. Service providers we share with

• SMS gateway (Text.lk) — receives your mobile number and the message text in order to deliver one-time codes.
• Hosting provider — stores the site and database on servers used to run the service.
• PayHere (payhere.lk) — if and when paid membership launches, payments are processed by PayHere. You enter your card or wallet details on PayHere's own secure page; we receive only the payment result and reference. We never see or store your full card number.

These providers act on our instructions for these purposes only. We may also disclose data where the law requires it, or to protect the rights and safety of our members.

6. How long we keep it

• Your account and profile are kept while your account is open.
• Delete your account and the profile is removed from the listing and deleted with it.
• One-time codes are stored hashed and expire within minutes; expired records are cleared.
• Server logs and any payment records are kept only as long as needed for security, accounting and legal purposes.

7. How we protect it

• The whole site is served over HTTPS.
• Passwords and one-time codes are stored hashed — never in plain text.
• OTP attempts are rate-limited and codes burn after repeated wrong guesses.
• Admin access is restricted to a separately authenticated panel.

No online service can promise perfect security, but we take these measures seriously and act quickly on any problem.

8. Your choices and rights

• See and correct — your account settings and My Profile page let you view and edit everything you have given us. Edits return the profile to pending review.
• Withdraw from the listing — ask us to unpublish your profile at any time.
• Delete — you can delete your account yourself from account settings, or ask us to do it.
• Object or complain — write to us and we will look into it. Sri Lanka's Personal Data Protection Act No. 9 of 2022 gives you rights over your data as its provisions come into force; we will honour valid requests under it.

We may need to confirm your identity — usually by an OTP to your registered number — before acting on a request.

9. Children

The service is for adults of marriageable age. It is not directed at anyone under 18, and we delete any profile we find belonging to a minor.

10. Changes and contact

We will update this policy as the service changes; the date above shows the current version, and material changes will be notified on the site. For any privacy question or request, contact support@nallanikah.com , or write to I.T. House, 38/2, Kandy Road, Welamboda, Sri Lanka.